New Banking and FinTech Regulations in the Philippines

25
October
2017

In the Philippines, FinTech is gaining popularity vis-à-vis the traditional brick and mortar approaches to banking and finance. In keeping with current developments, the Banko Sentral ng Pilipinas (BSP) issued the following circulars to mitigate technology related risks, among others:

  • BSP Circular No. 940 – Cash Agents Guidelines
  • BSP Circular No. 942 – Money Service Business Operations
  • BSP Circular No. 944 –  Virtual Currency Exchanges
  • BSP Circular No. 949 –  Social Media Risk Management

Banks and non-bank financial institutions engaged in remittance services, e-money, digital currency and other FinTech businesses, as well as banks that intend to outsource acceptance of deposits may find these circulars to be of interest.

For BSP, financial stability, consumer protection and public interest remain as the top priority. There is a need therefore, to perform a balancing act of promoting financial innovation with safeguards to manage risks at the same time.

Below are the key highlights of the Circulars issued by BSP:

BSP Circular No. 942: Money Service Business Operations

This Circular came into effect on 10 February 2017 and it applies to remittance and transfer companies (RTC), remittance subagents, money changers and those engaged in foreign exchange dealing (MC/FXD).

RTCs include e-money issuers (EMI) and remittance platform providers (RPP) who provide a shared or common platform or IT infrastructure and maintain settlement accounts in order to provide funds for remittance transactions within its network.

Before RTCs/MCs/FXDs can operate, they are required to register with BSP. Existing ones are also required to apply or re-register within 6 months from the effective date of the Circular.

Foreign RPPs that intend to do business in the Philippines are required to incorporate a local subsidiary within 2 years. Whilst the incorporation of the local subsidiary is pending, foreign RPPs may register through a resident agent which shall be liable for the obligations of the foreign RPP in the Philippines.

BSP Circular No. 940: Cash Agents Guidelines

Subject to BSP approval, this Circular allows a bank’s employees to solicit and accept deposits outside its premises.

Banks are also allowed to accredit third party service providers, to pick up and deliver cash and cheques on behalf of customers, subject to existing BSP rules on outsourcing. The bank may also contract third party cash agents to accept and disburse cash on its behalf, provided that:

  • the bank has an electronic banking solution to implement its cash agent operations; and
  • cash agents are only allowed to accept and disburse cash for deposit and withdrawal transactions, fund transfers, bill payments, and payments to government institutions, on the bank’s behalf.

For this purpose, a bank is required to provide its cash agents with a device for its customers to perform secure online, real-time deposit and withdrawal transactions, fund transfers and bill payments. This facilitates self-service transactions for customers.

Cash agents are also allowed to perform know-your-customer procedures and other related processes in accordance with existing regulations.

BSP Circular No. 944: Virtual Currency Exchanges

Issued on 6 February 2017, this Circular governs the operations and reporting obligations of virtual currency (VC) exchanges in the Philippines that offer services or engage in activities that provide facility for the conversion or exchanges of fiat currency to VC or vice versa.

The Circular also aims to regulate VC exchanges when used for delivery of financial services, particularly, for payments and remittances, which have material impact on anti-money laundering (AML) and combating the financing of terrorism (CFT), consumer protection and financial stability.

The Circular defines virtual currency as any type of digital unit that is used as a medium of exchange or a form of digitally stored value created by agreement within the community of VC users. The term is broadly construed to include digital units of exchange that:

  • have a centralized repository or administrator;
  • are decentralized and have no centralized repository or administrator; or
  • may be created or obtained by computing or manufacturing effort.

VC, however, excludes:

  • E-money, as defined in the Manual of Regulations for Banks;
  • digital units used solely within online gaming platforms and are not convertible to fiat currency or real-world goods or services; and
  • digital units with stored value redeemable exclusively in goods or services and limited to transactions involving a defined merchant such as rewards programs.

Bitcoin for instance was cited in the circular as an example of VC though the BSP does not intend to endorse it as a currency. The BSP has nevertheless, approved the registration of two companies to operate Bitcoin exchanges not long after the issuance of this Circular. These VCs will operate under similar guidelines as remittance and money exchange businesses.

To operate as a remittance and transfer company, a VC exchange must fulfill the following requirements:

  • obtain from the BSP a Certificate of Registration;
  • register with the Anti-Money Laundering Council as well as comply with notification and reporting requirements;
  • have adequate risk management and security control mechanisms to address, manage and mitigate technology risks associated with VCs;
  • have an effective cybersecurity program encompassing storage and transaction security requirements as well as sound key management practices to ensure the integrity and security of VC transactions for VC exchanges providing wallet services;
  • have up-to-date anti-malware solutions installed for those with simple VC operations;
  • conduct periodic back-ups and constant awareness of the emerging risks and other cyberattacks that may arise; and
  • use cheque or direct credit to deposit accounts for “large value pay-outs” of a single transaction of more than PHP500,000 (approximately USD10,000).

Violation of these requirements may subject the VC exchange to a variety of sanctions, including disqualification and cancellation of registration, AML penalties and, penalties and sanctions under local applicable laws.

BSP Circular No. 949: Social Media Risk Management

In Circular 949, the BSP aims to encourage BSP-Supervised Financial Institutions (BSFIs) to adopt appropriate risk management systems commensurate to the extent and degree of their use of social media platforms to promote their businesses and improve customer interaction.

Despite the advantages of using social media, the BSP recognizes that BSFIs may be exposed to compliance, legal, reputational, strategic, and operational risks. In this light, BSFIs are required to have a well-defined social media risk management strategy according to minimum standards and basic principles that govern BSFIs’ framework.

The Circular also requires BSFIs’ use of social media platforms to comply with applicable rules and regulations, especially on customer identification procedures under existing AML and regulations.

For BSFIs that opt to use social media for processing financial transactions, applicable BSP rules and regulations on electronic banking and electronic services and technology risk management should likewise be observed to ensure security, reliability and authenticity of such transactions. BSFIs are likewise required to conform with BSP regulations on the outsourcing framework, if they outsource the conduct of social media-related activities to a service provider.

BSFIs are required to comply with prescribed standards on social media risk management by September 2017. In this regard, the BSFI must be able to show its plan of action with specific timelines and the status of initiatives being undertaken to fully comply with the Circular upon request of the BSP.

Conclusion

With the growing number of Filipinos who use mobile banking technology to transact with banks and non-bank financial institutions, the BSP’s efforts in encouraging financial innovation to serve the financially excluded and unbanked is a welcome change.

In keeping with emerging FinTech, the BSP is looking to update rules on corporate governance as well as risk management. Furthermore, the BSP is also said to be currently drafting enhanced rules on information technology to tighten rules and guard against cyber threats.

If you have any questions or require any additional information, please contact Felix Sy, Lorybeth Baldrias Serrano or the ZICO Law Partner you usually deal with.


This alert is for general information only and is not a substitute for legal advice.